More

Author: mjang

content/includes/nginx-one/add-file/existing-ssl-bundle.md

@@ -0,0 +1,16 @@
+---
+docs:
+---
+
+With this option, You can incorporate [Managed certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}).
+In the **Choose Certificate** drop-down, select the managed certificate of your choice, and select **Add**. You can then:
+
+1. Review details of the certificate. The next steps depend on whether the certificate is a CA bundle or a certificate / key pair.
+1. Enter the **Certificate File Path**, such as `/etc/ssl/nginx/mycert.crt` or `/etc/ssl/nginx/mycert.pem`.
+1. If you selected a key pair, you'll also enter the **Key File Path**, such as `/etc/ssl/nginx/mycert.key`.
+1. If you select **Add Item**, you can add the same certificate or key to another directory.
+1. Select **Add**. You should now be returned to the **Edit Configuration** window.
+   You should now see the files you specified in the directory tree.
+1. Select **Next** and then **Save and Publish**.
+   You may see a message that suggests publication is in progress.
+1. When publication is complete, you're taken back to the **Configuration** tab. You should see the updated configuration in the window.

content/includes/nginx-one/add-file/new-ssl-bundle.md

@@ -11,7 +11,23 @@ You can add certificates in the following formats:
 - **SSL Certificate and Key**
 - **CA Certificate Bundle**
 
-In each case, you can upload files directly, or enter the content of the certificates in a text box. Once you upload these certificates, you'll see:
+In each case, you can upload files directly, or enter the content of the certificates in a text box. Once you upload these certificates, you may need to scroll down. You'll see:
 
 - **Certificate Details**, with the Subject Name, start and end dates. 
 - **Key Details**, with the encryption key size and algorithm, such as RSA
+
+Select **Save and Continue**. You're taken to another screen where you can specify the locations for your files, which may be:
+
+- **Certificate File Path**
+  - Enter the full path to your certificate, such as
+    - /etc/ssl/nginx/server.crt
+    - /etc/ssl/nginx/server.pem
+
+- **Key File Path**
+  - Enter the full path to your certificate key, such as
+    - /etc/ssl/nginx/server.key
+  - If you're using a `.pem` file, you won't have a separate key.
+
+With the **Add Item** button, you can add the file to additional directories.
+
+When complete, select **Add** to include the certificate files that you've configured to desired directories.

content/nginx-one/how-to/certificates/manage-certificates.md

@@ -16,11 +16,13 @@ This guide explains how you can manage SSL/TLS certificates with the F5 NGINX On
 
 You may have separate sets of SSL/TLS certificates, as described in the following table: 
 
+{{<bootstrap-table "table table-striped table-bordered">}}
 | Functionality     | Typical file names                                                 | Notes                                                                                  |
 |-------------------|--------------------------------------------------------------------|----------------------------------------------------------------------------------------|
-| Website traffic   | /etc/nginx/ssl/example.com.crt <br> /etc/nginx/ssl/example.com.key | Typically purchased from a Certificate Authority (CA).                                 |
-| Repository access | /etc/ssl/nginx/nginx-repo.crt <br> /etc/ssl/nginx/nginx-repo.key   | Supports access to repositories to download and install NGINX packages.                |
-| NGINX Licensing   | /etc/ssl/nginx/server.crt <br> /etc/ssl/nginx/server.key   | Supports access to repositories. Based on licenses downloaded from https://my.f5.com/. Time limited. |
+| Website traffic   | /etc/nginx/ssl/example.com.crt <br> /etc/nginx/ssl/example.com.key | Typically purchased from a Certificate Authority (CA)                                 |
+| Repository access | /etc/ssl/nginx/nginx-repo.crt <br> /etc/ssl/nginx/nginx-repo.key   | Supports access to repositories to download and install NGINX packages                |
+| NGINX Licensing   | /etc/ssl/nginx/server.crt <br> /etc/ssl/nginx/server.key   | Supports access to repositories. Based on licenses downloaded from https://my.f5.com/ |
+{{</bootstrap-table>}}
 
 Allowed directories depend on the [NGINX Agent]({{< relref "/nginx-one/getting-started/#install-nginx-agent" >}}). Look for the `/etc/nginx-agent/nginx-agent.conf` file.
 Find the `config_dirs` parameter in that file, as described in the NGINX Agent [Basic configuration](https://docs.nginx.com/nginx-agent/configuration/configuration-overview/#cli-flags--environment-variables).
@@ -65,7 +67,18 @@ The NGINX One Console allows you to upload these certificates as text and as fil
 Make sure your certificates, keys, and pem files are encrypted to one of the following standards:
 
 - RSA
-- ECDSA
+- ECC/ECDSA
+
+In other words, any private key of this type should be supported, regardless of the curve types or hashing algorithm.
+
+For exmaple, if you use ECDSA private keys in PEM format, the PEM headers should contain:
+
+```
+-----BEGIN EC PRIVATE KEY-----
+<...base64-encoded key>
+-----END EC PRIVATE KEY-----
+
+```
 
 If you use one of these keys, the US National Institute of Standards and Technology, in [Publication 800-57 Part 3 (PDF)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57Pt3r1.pdf), recommends a key size of at least
 2048 bits. It also has recommnedations for ECDSA.

content/nginx-one/how-to/config-sync-groups/add-file-csg.md

@@ -4,7 +4,7 @@ doctypes:
     - task
 tags:
     - docs
-title: Add a file in a Config Sync Group
+title: Add a file to a Config Sync Group
 toc: true
 weight: 400
 ---
@@ -60,17 +60,8 @@ Enter the name of the desired configuration file, such as `abc.conf` and select
 
 ### Existing SSL Certificate or CA Bundle
 
+{{< include "nginx-one/add-file/existing-ssl-bundle.md" >}}
 With this option, You can incorporate [Managed certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}).
-In the **Choose Certificate** drop-down, select the managed certificate of your choice, and select **Add**. You can then:
-
-1. Review details of the certificate. The next steps depend on whether the certificate is a CA bundle or a certificate / key pair.
-1. Enter the **Certificate File Path**, such as `/etc/ssl/nginx/mycert.crt`.
-1. If you selected a key pair, you'll also enter the **Key File Path**, such as `/etc/ssl/nginx/mycert.key`.
-1. Select **Add**. You should now be returned to the **Edit Configuration** window.
-   You should now see the files you specified in the directory tree.
-1. Select **Next** and then **Save and Publish**.
-   You may see a message that suggests publication is in progress.
-1. When publication is complete, you're taken back to the **Configuration** tab. You should see the updated configuration in the window.
 
 ## See also
 

content/nginx-one/how-to/nginx-configs/add-file.md

@@ -61,18 +61,7 @@ Enter the name of the desired configuration file, such as `abc.conf` and select
 
 ### Existing SSL Certificate or CA Bundle
 
-With this option, You can incorporate [Managed certificates]({{< relref "/nginx-one/how-to/certificates/manage-certificates.md#managed-and-unmanaged-certificates" >}}).
-In the **Choose Certificate** drop-down, select the managed certificate of your choice, and select **Add**. You can then:
-
-1. Review details of the certificate. The next steps depend on whether the certificate is a CA bundle or a certificate / key pair.
-1. Enter the **Certificate File Path**, such as `/etc/ssl/nginx/mycert.crt`.
-1. If you selected a key pair, you'll also enter the **Key File Path**, such as `/etc/ssl/nginx/mycert.key`.
-1. Select **Add**. You should now be returned to the **Edit Configuration** window.
-   You should now see the files you specified in the directory tree.
-1. Select **Next** and then **Save and Publish**.
-   You may see a message that suggests publication is in progress.
-   - If the instance is offline, **Save and Publish** does not work.
-1. When publication is complete, you're taken back to the **Configuration** tab. You should see the updated configuration in the window.
+{{< include "nginx-one/add-file/existing-ssl-bundle.md" >}}
 
 ## See also